EUVD-2026-39536Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious agent input can be delivered remotely (AV:N) and the bypass is deterministic (AC:L, PR:N, UI:N); escaping the sandbox to compromise the host is a scope change (S:C) with full C/I/A loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the workspace and force canonicalization to fail - either because the target does not exist or because read permission is removed from the path - so the agent writes through the symlink to an arbitrary location without approval. A malicious agent could write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution - for example by overwriting the cursorsandbox helper so later commands run unsandboxed - with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.
AnalysisAI
Sandbox escape leading to non-sandboxed remote code execution in Cursor (the AI code editor) prior to version 3.0, where a malicious agent can write files outside the protected workspace. Cursor canonicalizes a Write target to confirm it stays in-workspace, but when canonicalization fails it insecurely falls back to the raw path and writes without approval; an agent can deliberately force this failure via an in-workspace symlink pointing outside the workspace (target missing or read permission stripped) to write arbitrary files under the user's privileges. Overwriting the cursorsandbox helper then causes later commands to run unsandboxed, yielding full RCE with no user interaction beyond a benign prompt. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The flaw is a link-following / path-canonicalization weakness (CWE-59) in Cursor's agent terminal sandbox, which is enabled by default in pre-3.0 builds and is meant to confine agent-issued file writes to the user's workspace. The intended control resolves (canonicalizes) the target path and rejects writes whose real path lands outside the workspace. The defect is the fail-open fallback: when canonicalization errors out, the code reverts to the original, unresolved path and proceeds without the normal approval gate. Because symlink resolution can be made to fail deterministically - pointing a symlink at a non-existent target, or removing read permission on a component of the path - an attacker controls the failure condition rather than encountering it by chance. The affected component is cpe:2.3:a:cursor:cursor across all versions before 3.0. This is a classic TOCTOU-style symlink bypass of a security boundary, amplified because the sandbox helper binary (cursorsandbox) itself becomes a writable target, turning a file-write primitive into code execution.
RemediationAI
Upgrade to Cursor 3.0 or later, which fixes the canonicalization fail-open behavior - this is the primary and vendor-confirmed remediation (Vendor-released patch: 3.0), documented in advisory GHSA-3v8f-48vw-3mjx (https://github.com/cursor/cursor/security/advisories/GHSA-3v8f-48vw-3mjx). Until upgrading, reduce exposure by not running the agent against untrusted or attacker-influenced repositories and codebases, since the attack requires the agent to be steered into creating the malicious symlink and write; treat agent processing of third-party code as the trigger to avoid. Where the workflow allows, disable or avoid auto-approved agent Write/terminal actions so writes require explicit human review (trade-off: significantly more interruptions and reduced agent autonomy), and run Cursor under a least-privileged OS user without write access to sensitive locations or the cursorsandbox helper path so a successful symlink write cannot overwrite the sandbox binary (trade-off: may break workflows expecting broad filesystem access). These are mitigations only; none fully closes the fail-open path the way the 3.0 fix does.
Arbitrary code execution in Cursor for Windows 3.2.16 lets remote attackers run code on a developer's machine by plantin
Cursor AI code editor before 2.3 allows prompt injection to bypass the Agent's Allowlist mode. Shell built-ins can execu
Sandbox escape leading to non-sandboxed remote code execution affects the Cursor AI code editor prior to version 3.0, wh
Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific
Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication wit
Cursor is a code editor built for programming with AI. versions up to 2.0 is affected by os command injection.
Unauthorized hook command execution in Cursor Desktop versions prior to 3.0.0 allows a malicious workspace to silently r
Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the wa
Cursor versions before 2.5 allow sandbox escape through improper .git configuration file protections, enabling malicious
Server-side request forgery leading to code execution in Cursor's browser-enabled Cloud Agent lets attacker-controlled w
Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (R
Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today